Magecart Turns the Cart Page Into a Counterfeit Checkout
Source Defense Research identified a Magecart attack that places a complete fake checkout over a store’s cart page, before the shopper reaches the legitimate payment page. The browser still shows the merchant’s URL, and the counterfeit form displays the shopper’s real cart. A customer can therefore enter an address and card details into an attacker-controlled checkout without seeing an unfamiliar website.
Attack details
The attack begins with obfuscated code embedded in the compromised page. It runs when a tiny SVG element loads and checks for a URL containing /checkout/—which can include a cart route such as /checkout/cart/. It then loads a script from difastlink[.]com. The next stage gathers browser characteristics, including screen, canvas, and WebGL information. The supplied code also contains a developer-tools detection function, but the available capture does not establish whether that function determines who sees the fake checkout.
The script creates a full-screen iframe containing the counterfeit checkout. It covers the store page while leaving the original cart underneath. On the analyzed Magento site, the fake checkout reads cart information from browser storage and displays the actual products, images, quantities, prices, and total. It asks for contact and shipping details, a card number, expiration date, and security code. Card-format checks help the attacker collect plausible payment details.
When the shopper clicks the fake order button, the code is designed to collect the form entries, encode them, and place them in the news parameter of a request to bb.billgchain[.]com/bb. Encoding changes how the data appears in transit; it does not protect it. In the analyzed code, difastlink[.]com delivers the script and supports visitor profiling, while bb.billgchain[.]com is the destination specified for the captured form data. Researchers also observed other domains during the investigation, but their roles may differ across sites or variants.
How Source Defense protects you
Source Defense client-side security protects the shopping journey wherever an attack unfolds, including cart pages that attackers turn into counterfeit checkouts. It identifies suspicious scripts and evaluates their behavior in real time, giving teams the visibility and control to protect customer data before it leaves the browser.
Source Defense combines intelligence about malicious infrastructure with behavior-based policies. This allows protection to act on known threats while continuing to detect suspicious activity as attackers change their domains and tactics.
How Source Defense alerts you
Source Defense can alert you when a script loads from a blacklisted domain – in the Loaded from a blacklisted domain widget or sends data to one – Sending data to a blacklisted domain behavior. In this attack, it can also highlight additional behaviors such as Accessing PCI data, Accessing PII data, and Using browser storage. These signals help show how the malicious code arrived and what it did in the shopper’s browser
Key takeaways
In this attack, the shopper can hand over card details without ever reaching the real payment page. The address bar still shows the merchant’s site, and the fake checkout displays the contents of the real cart. Protecting only known payment URLs leaves the page where the theft begins exposed.
Source Defense’s client-side security covers the broader shopping journey, including the cart page. It can identify malicious script sources, detect attempts to access and send sensitive data, and apply policies in the browser before that data leaves. As attackers move their fake checkout or change domains, real-time, behavior-based protection remains focused on the threat that matters: what their code does to the shopper.
